1 Answer

-s is short for --string. It expects, quote, “a string provided as an argument” [emphasis added]. So << EOT is consumed by the shell. The shell redirects the heredoc as stdin to the process. Consequently, it's plausible that eyaml(1) complains.

You probably wanted to do something like:

eyaml encrypt --stdin << EOT

Anyways, why do you care about encrypting a certificate? Isn't it a public certificate you're trying to encrypt?